Amazon Linux 2023 Security Advisory: ALAS2023-2026-3333
Advisory Released Date: 2026-10-24
Advisory Updated Date: 2026-10-26
Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for Rust and custom service implementations.
Uncontrolled recursion in the JSON, CBOR, and XML deserializer functions emitted by Amazon smithy-rs code generation could allow remote attackers to cause a denial of service (process abort via stack exhaustion) via a small request containing deeply nested data for a recursive model shape to a generated SDK or server.
To mitigate this issue, users should upgrade to aws-sdk-rust release-2026-06-02 or later. Users building custom servers with smithy-rs codegen should regenerate from smithy-rs release-2026-06-01 or later. (CVE-2026-15957)
Affected Packages:
amazon-efs-utils
Issue Correction:
Run dnf update amazon-efs-utils --releasever 2023.12.20261026 or dnf update --advisory ALAS2023-2026-3333 --releasever 2023.12.20261026 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation
aarch64:
amazon-efs-utils-3.1.3-1.amzn2023.aarch64
src:
amazon-efs-utils-3.1.3-1.amzn2023.src
x86_64:
amazon-efs-utils-3.1.3-1.amzn2023.x86_64